worldquant-miner-cn
Warn
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The documentation instructs users to store their WorldQuant Brain email and password in a plaintext file named
credential.txtusing the commandecho '["email", "password"]' > credential.txt. Storing secrets in plaintext on the filesystem is a significant security risk as it allows any process or user with read access to the file to compromise the account. - [COMMAND_EXECUTION]: The skill provides numerous shell commands for environment setup, including credential creation, dependency installation, and Docker container orchestration (
docker-compose up). - [EXTERNAL_DOWNLOADS]: The skill references and integrates code from external GitHub repositories, specifically
github.com/zhutoutoutousan/worldquant-minerandgithub.com/yli188/WorldQuant_alpha101_code. These sources are not associated with verified organizations and could introduce unvetted code into the user's environment. - [DATA_EXFILTRATION]: The skill is designed to transmit user-provided credentials and generated financial algorithms to the WorldQuant Brain API at
platform.worldquantbrain.com. While this is part of the intended workflow, users should be aware that their credentials and potentially proprietary trading strategies are being sent to an external service.
Audit Metadata